vouchington-tooling 0.16.1 → 0.18.0

package/README.md

@@ -238,6 +238,10 @@ import { runCiLocal } from 'vouchington-tooling/ci-local'
 import { rateLimitDelay } from 'vouchington-tooling/gha-rate-limit'
 import { parseCheckpoint } from 'vouchington-tooling/gha-pr-checkpoint'
 import { checkWorkspaceGatesPolicy } from 'vouchington-tooling/workspace-gates'
+import {
+  collectPnpmLicenseReport,
+  evaluatePnpmLicenseReport,
+} from 'vouchington-tooling/dependency-license-policy'
 import { checkGhaWorkspacePolicy } from 'vouchington-tooling/gha-workspace-policy'
 import { requireUpToDate } from 'vouchington-tooling/require-up-to-date'
 import { runGitleaksDirectoryScan } from 'vouchington-tooling/gitleaks-directory-scan'
@@ -306,6 +310,17 @@ policy out of this package.
 dependency declared by a non-fixture package manifest. Assert dependency membership or placement,
 or derive a configuration or documentation package spec from that manifest instead.
 
+`dependency-license-policy` keeps legal policy in the consumer. `collectPnpmLicenseReport` creates
+an isolated, script-free temporary workspace and store, expands pnpm's supported architectures to
+every `os`, `cpu`, and `libc` selector represented in the lockfile, and validates the JSON report.
+Pass explicit denied SPDX IDs and prefixes, exact aliases, and justified allowlist scopes to
+`evaluatePnpmLicenseReport`. Unknown, malformed, and custom SPDX references fail closed. Allowlist
+scopes are either intentionally global or an exact package-name set; the library returns structured
+violations and does not format CI-provider diagnostics.
+When present, the repository `.npmrc` is copied into the owner-private temporary directory so pnpm
+can authenticate to the same registries; normal cleanup removes the copy, and the caller remains
+responsible for terminating the process normally rather than abandoning temporary audit state.
+
 `session-friction` is an opt-in capture and reporting library. Callers supply the session id,
 absolute log directory, host-independent observation, and journal loader; it does not inspect host
 environment variables, install hooks, or connect to a journal service by itself. Invoking

package/dist/dependency-license-policy/collect.d.mts

@@ -0,0 +1,9 @@
+import type { PnpmExecutor, PnpmLicenseReport } from './types.mts';
+import { type PnpmLicenseAuditWorkspace } from './workspace.mts';
+export interface CollectPnpmLicenseReportOptions {
+    readonly execute?: PnpmExecutor;
+    readonly prepareWorkspace?: (repoRoot: string, lockfileSource: string, workspaceSource: string) => PnpmLicenseAuditWorkspace;
+    readonly readFile?: (path: string, encoding: 'utf8') => string;
+}
+/** Collects licenses for every platform represented in a pnpm lockfile. */
+export declare function collectPnpmLicenseReport(repoRoot: string, options?: CollectPnpmLicenseReportOptions): PnpmLicenseReport;

package/dist/dependency-license-policy/collect.mjs

@@ -0,0 +1,48 @@
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { parsePnpmLicenseReport } from './report.mjs';
+import { preparePnpmLicenseAuditWorkspace } from './workspace.mjs';
+const DEFAULT_OPTIONS = {
+    execute: spawnSync,
+    prepareWorkspace: preparePnpmLicenseAuditWorkspace,
+    readFile: readFileSync,
+};
+function commandFailureOutput(result) {
+    return result.stderr.trim() || result.stdout.trim();
+}
+function assertCommandSucceeded(label, result) {
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        throw new Error(`${label} exited with status ${String(result.status)}: ${commandFailureOutput(result)}`);
+    }
+}
+/** Collects licenses for every platform represented in a pnpm lockfile. */
+export function collectPnpmLicenseReport(repoRoot, options = {}) {
+    const { execute, prepareWorkspace, readFile } = { ...DEFAULT_OPTIONS, ...options };
+    const lockfilePath = join(repoRoot, 'pnpm-lock.yaml');
+    const workspacePath = join(repoRoot, 'pnpm-workspace.yaml');
+    const auditWorkspace = prepareWorkspace(repoRoot, readFile(lockfilePath, 'utf8'), readFile(workspacePath, 'utf8'));
+    try {
+        const storeConfig = `--config.store-dir=${join(auditWorkspace.cwd, '.pnpm-store')}`;
+        const fetchResult = execute('pnpm', [storeConfig, '--config.force=true', 'fetch', '--ignore-scripts'], { cwd: auditWorkspace.cwd, encoding: 'utf8' });
+        assertCommandSucceeded('pnpm fetch', fetchResult);
+        const result = execute('pnpm', [storeConfig, 'licenses', 'list', '--json'], {
+            cwd: auditWorkspace.cwd,
+            encoding: 'utf8',
+        });
+        assertCommandSucceeded('pnpm licenses list --json', result);
+        try {
+            return parsePnpmLicenseReport(JSON.parse(result.stdout));
+        }
+        catch (error) {
+            throw new Error(`pnpm licenses list --json produced unparseable output: ${String(error)}`, {
+                cause: error,
+            });
+        }
+    }
+    finally {
+        auditWorkspace.cleanup();
+    }
+}

package/dist/dependency-license-policy/index.d.mts

@@ -0,0 +1,4 @@
+export { collectPnpmLicenseReport, type CollectPnpmLicenseReportOptions } from './collect.mts';
+export { evaluatePackageLicenseExpression, evaluatePnpmLicenseReport } from './policy.mts';
+export { parsePnpmLicenseReport } from './report.mts';
+export type { DependencyLicenseAllowlistEntry, DependencyLicenseEvaluation, DependencyLicensePolicy, DependencyLicenseViolation, PnpmExecutor, PnpmLicenseReport, PnpmLicenseReportEntry, } from './types.mts';

package/dist/dependency-license-policy/index.mjs

@@ -0,0 +1,3 @@
+export { collectPnpmLicenseReport } from './collect.mjs';
+export { evaluatePackageLicenseExpression, evaluatePnpmLicenseReport } from './policy.mjs';
+export { parsePnpmLicenseReport } from './report.mjs';

package/dist/dependency-license-policy/policy.d.mts

@@ -0,0 +1,3 @@
+import type { DependencyLicenseEvaluation, DependencyLicensePolicy, DependencyLicenseViolation, PnpmLicenseReport } from './types.mts';
+export declare function evaluatePackageLicenseExpression(licenseExpression: string, packageName: string, policy: DependencyLicensePolicy): DependencyLicenseEvaluation;
+export declare function evaluatePnpmLicenseReport(report: PnpmLicenseReport, policy: DependencyLicensePolicy): DependencyLicenseViolation[];

package/dist/dependency-license-policy/policy.mjs

@@ -0,0 +1,40 @@
+import { collectSpdxAtoms, evaluateSpdxExpression, parseSpdxExpression } from './spdx.mjs';
+function isAllowlisted(atomId, packageName, policy) {
+    return (policy.allowlist ?? []).some((entry) => entry.licenseId === atomId &&
+        (entry.scope.kind === 'all' || entry.scope.packageNames.includes(packageName)));
+}
+function isDenied(atomId, policy) {
+    return (policy.deniedLicenseIds.includes(atomId) ||
+        policy.deniedLicensePrefixes.some((prefix) => atomId.startsWith(prefix)));
+}
+export function evaluatePackageLicenseExpression(licenseExpression, packageName, policy) {
+    const normalized = policy.knownLicenseAliases?.[licenseExpression] ?? licenseExpression;
+    let node;
+    try {
+        node = parseSpdxExpression(normalized);
+    }
+    catch {
+        return { ok: false, deniedAtoms: [licenseExpression] };
+    }
+    const isAtomAllowed = (atomId) => isAllowlisted(atomId, packageName, policy) || !isDenied(atomId, policy);
+    const ok = evaluateSpdxExpression(node, isAtomAllowed);
+    const deniedAtoms = ok ? [] : collectSpdxAtoms(node).filter((atomId) => !isAtomAllowed(atomId));
+    return { ok, deniedAtoms };
+}
+export function evaluatePnpmLicenseReport(report, policy) {
+    const violations = [];
+    for (const [licenseExpression, entries] of Object.entries(report)) {
+        for (const entry of entries) {
+            const evaluation = evaluatePackageLicenseExpression(licenseExpression, entry.name, policy);
+            if (evaluation.ok)
+                continue;
+            violations.push({
+                ...evaluation,
+                licenseExpression,
+                packageName: entry.name,
+                ...(entry.versions === undefined ? {} : { versions: entry.versions }),
+            });
+        }
+    }
+    return violations;
+}

package/dist/dependency-license-policy/report.d.mts

@@ -0,0 +1,2 @@
+import type { PnpmLicenseReport } from './types.mts';
+export declare function parsePnpmLicenseReport(value: unknown): PnpmLicenseReport;

package/dist/dependency-license-policy/report.mjs

@@ -0,0 +1,30 @@
+function getStringList(value, path) {
+    if (!Array.isArray(value) || !value.every((entry) => typeof entry === 'string')) {
+        throw new Error(`expected ${path} to be an array of strings`);
+    }
+    return value;
+}
+export function parsePnpmLicenseReport(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error('expected a JSON object keyed by license expression');
+    }
+    const report = Object.create(null);
+    for (const [licenseExpression, entries] of Object.entries(value)) {
+        if (!Array.isArray(entries)) {
+            throw new Error(`expected license group ${JSON.stringify(licenseExpression)} to be an array`);
+        }
+        report[licenseExpression] = entries.map((entry, index) => {
+            const path = `license group ${JSON.stringify(licenseExpression)} entry ${String(index)}`;
+            if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
+                throw new Error(`expected ${path} to be an object`);
+            }
+            const { name, versions } = entry;
+            if (typeof name !== 'string')
+                throw new Error(`expected ${path}.name to be a string`);
+            if (versions === undefined)
+                return { name };
+            return { name, versions: getStringList(versions, `${path}.versions`) };
+        });
+    }
+    return report;
+}

package/dist/dependency-license-policy/spdx.d.mts

@@ -0,0 +1,13 @@
+export type SpdxNode = {
+    type: 'AND';
+    children: SpdxNode[];
+} | {
+    type: 'OR';
+    children: SpdxNode[];
+} | {
+    type: 'ATOM';
+    id: string;
+};
+export declare function parseSpdxExpression(expression: string): SpdxNode;
+export declare function evaluateSpdxExpression(node: SpdxNode, isAtomAllowed: (atomId: string) => boolean): boolean;
+export declare function collectSpdxAtoms(node: SpdxNode): string[];

package/dist/dependency-license-policy/spdx.mjs

@@ -0,0 +1,40 @@
+import parseSpdx from 'spdx-expression-parse';
+function isCustomLicenseReference(licenseId) {
+    return licenseId.startsWith('LicenseRef-') || licenseId.startsWith('DocumentRef-');
+}
+function convertParsedNode(parsed) {
+    if ('license' in parsed) {
+        if (isCustomLicenseReference(parsed.license)) {
+            throw new Error(`Custom SPDX license references are not allowed: ${parsed.license}`);
+        }
+        const id = `${parsed.license}${parsed.plus ? '+' : ''}${parsed.exception ? ` WITH ${parsed.exception}` : ''}`;
+        return { type: 'ATOM', id };
+    }
+    const type = parsed.conjunction === 'and' ? 'AND' : 'OR';
+    const children = [convertParsedNode(parsed.left), convertParsedNode(parsed.right)].flatMap((child) => (child.type === type ? child.children : [child]));
+    return { type, children };
+}
+export function parseSpdxExpression(expression) {
+    if (expression.trim().length === 0) {
+        throw new Error('Invalid SPDX license expression: expression is empty');
+    }
+    try {
+        return convertParsedNode(parseSpdx(expression));
+    }
+    catch (error) {
+        throw new Error(`Invalid SPDX license expression: ${String(error)}`, { cause: error });
+    }
+}
+export function evaluateSpdxExpression(node, isAtomAllowed) {
+    if (node.type === 'ATOM')
+        return isAtomAllowed(node.id);
+    if (node.type === 'OR') {
+        return node.children.some((child) => evaluateSpdxExpression(child, isAtomAllowed));
+    }
+    return node.children.every((child) => evaluateSpdxExpression(child, isAtomAllowed));
+}
+export function collectSpdxAtoms(node) {
+    if (node.type === 'ATOM')
+        return [node.id];
+    return node.children.flatMap(collectSpdxAtoms);
+}

package/dist/dependency-license-policy/types.d.mts

@@ -0,0 +1,43 @@
+export interface PnpmLicenseReportEntry {
+    readonly name: string;
+    readonly versions?: readonly string[];
+}
+/** Shape emitted by `pnpm licenses list --json`. */
+export type PnpmLicenseReport = Record<string, PnpmLicenseReportEntry[]>;
+export type PnpmExecutor = (command: string, args: string[], options: {
+    cwd: string;
+    encoding: 'utf8';
+}) => {
+    error?: Error;
+    status: number | null;
+    stderr: string;
+    stdout: string;
+};
+export interface DependencyLicenseAllowlistEntry {
+    /** Exact SPDX atom allowed by this entry. */
+    readonly licenseId: string;
+    /** Human-readable evidence for the exception. */
+    readonly reason: string;
+    /** Explicit package scope for this allowance. */
+    readonly scope: {
+        readonly kind: 'all';
+    } | {
+        readonly kind: 'exact';
+        readonly packageNames: readonly string[];
+    };
+}
+export interface DependencyLicensePolicy {
+    readonly allowlist?: readonly DependencyLicenseAllowlistEntry[];
+    readonly deniedLicenseIds: readonly string[];
+    readonly deniedLicensePrefixes: readonly string[];
+    readonly knownLicenseAliases?: Readonly<Record<string, string>>;
+}
+export interface DependencyLicenseEvaluation {
+    readonly deniedAtoms: readonly string[];
+    readonly ok: boolean;
+}
+export interface DependencyLicenseViolation extends DependencyLicenseEvaluation {
+    readonly licenseExpression: string;
+    readonly packageName: string;
+    readonly versions?: readonly string[];
+}

package/dist/dependency-license-policy/types.mjs

@@ -0,0 +1 @@
+export {};

package/dist/dependency-license-policy/workspace.d.mts

@@ -0,0 +1,9 @@
+export interface PnpmLicenseAuditWorkspace {
+    readonly cleanup: () => void;
+    readonly cwd: string;
+}
+export declare function renderPnpmLicenseAuditWorkspace(lockfileSource: string, workspaceSource: string, paths: {
+    lockfile: string;
+    workspace: string;
+}): string;
+export declare function preparePnpmLicenseAuditWorkspace(repoRoot: string, lockfileSource: string, workspaceSource: string): PnpmLicenseAuditWorkspace;

package/dist/dependency-license-policy/workspace.mjs

@@ -0,0 +1,77 @@
+import { copyFileSync, existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+const PLATFORM_KEYS = ['os', 'cpu', 'libc'];
+function parseYamlObject(source, path) {
+    let parsed;
+    try {
+        parsed = parseYaml(source);
+    }
+    catch (error) {
+        throw new Error(`failed to parse ${path}: ${String(error)}`, { cause: error });
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`expected ${path} to contain a YAML object`);
+    }
+    return parsed;
+}
+function getStringList(value, path) {
+    if (typeof value === 'string')
+        return [value];
+    if (!Array.isArray(value) || !value.every((entry) => typeof entry === 'string')) {
+        throw new Error(`expected ${path} to be a string or an array of strings`);
+    }
+    return value;
+}
+export function renderPnpmLicenseAuditWorkspace(lockfileSource, workspaceSource, paths) {
+    const lockfile = parseYamlObject(lockfileSource, paths.lockfile);
+    const workspace = parseYamlObject(workspaceSource, paths.workspace);
+    const packages = lockfile.packages;
+    if (typeof packages !== 'object' || packages === null || Array.isArray(packages)) {
+        throw new Error(`expected ${paths.lockfile} to contain a packages object`);
+    }
+    const supportedArchitectures = {
+        cpu: ['current'],
+        libc: ['current'],
+        os: ['current'],
+    };
+    for (const key of PLATFORM_KEYS) {
+        const values = new Set();
+        for (const snapshot of Object.values(packages)) {
+            if (typeof snapshot !== 'object' || snapshot === null || Array.isArray(snapshot))
+                continue;
+            const value = snapshot[key];
+            if (value === undefined)
+                continue;
+            for (const platform of getStringList(value, `${paths.lockfile} packages.*.${key}`)) {
+                values.add(platform);
+            }
+        }
+        supportedArchitectures[key].push(...[...values].filter((value) => value !== 'current').sort());
+    }
+    return stringifyYaml({ ...workspace, packages: [], supportedArchitectures });
+}
+export function preparePnpmLicenseAuditWorkspace(repoRoot, lockfileSource, workspaceSource) {
+    const auditRoot = mkdtempSync(join(tmpdir(), 'dependency-license-audit-'));
+    try {
+        for (const filename of ['package.json', 'pnpm-lock.yaml']) {
+            copyFileSync(join(repoRoot, filename), join(auditRoot, filename));
+        }
+        const npmrc = join(repoRoot, '.npmrc');
+        if (existsSync(npmrc))
+            copyFileSync(npmrc, join(auditRoot, '.npmrc'));
+        writeFileSync(join(auditRoot, 'pnpm-workspace.yaml'), renderPnpmLicenseAuditWorkspace(lockfileSource, workspaceSource, {
+            lockfile: join(repoRoot, 'pnpm-lock.yaml'),
+            workspace: join(repoRoot, 'pnpm-workspace.yaml'),
+        }), 'utf8');
+    }
+    catch (error) {
+        rmSync(auditRoot, { force: true, recursive: true });
+        throw error;
+    }
+    return {
+        cwd: auditRoot,
+        cleanup: () => rmSync(auditRoot, { force: true, recursive: true }),
+    };
+}

package/dist/github-projects/index.d.mts

@@ -0,0 +1,4 @@
+export { auditProjectCompletion, formatProjectAdvisories, formatProjectAdvisoryReport, groupClosedIssuesByProject, } from './project-audit.mts';
+export type { ClosingIssueRef } from './project-audit.mts';
+export { buildIssueProjectItemsArgs, buildProjectItemsArgs, DEFAULT_PROJECT_COMPLETION_REMAINDER, fetchIssueProjectMemberships, findProjectCompletionSiblings, isProjectScopeError, } from './project-query.mts';
+export type { ProjectGroup, ProjectMembershipResult, ProjectRef, ProjectSibling, } from './project-query.mts';

package/dist/github-projects/index.mjs

@@ -0,0 +1,2 @@
+export { auditProjectCompletion, formatProjectAdvisories, formatProjectAdvisoryReport, groupClosedIssuesByProject, } from './project-audit.mjs';
+export { buildIssueProjectItemsArgs, buildProjectItemsArgs, DEFAULT_PROJECT_COMPLETION_REMAINDER, fetchIssueProjectMemberships, findProjectCompletionSiblings, isProjectScopeError, } from './project-query.mjs';

package/dist/github-projects/project-audit.d.mts

@@ -0,0 +1,32 @@
+import type { RunTextCommand } from '../gh-cli/index.mts';
+import { type ProjectGroup, type ProjectRef, type ProjectSibling } from './project-query.mts';
+/** One issue this change closes: a bare number, plus the `owner/repo` it lives in when that
+ * differs from the audited repo (`undefined` means the audited repo itself). */
+export type ClosingIssueRef = {
+    number: number;
+    repo?: string | undefined;
+};
+type ClosingIssueProjects = {
+    closingKey: string;
+    projects: ProjectRef[];
+};
+/**
+ * Groups a change's closing issues by the open project(s) each belongs to. An issue may belong to
+ * more than one open project (see `fetchIssueProjectMemberships`) — every one it belongs to gets
+ * its own group entry here, audited independently rather than picked arbitrarily.
+ */
+export declare function groupClosedIssuesByProject(entries: ReadonlyArray<ClosingIssueProjects>): Map<string, ProjectGroup>;
+/** Purely advisory formatting: there is no in-body disposition marker to check against, unlike a
+ * milestone-completion audit — every remaining sibling is reported unconditionally. */
+export declare function formatProjectAdvisories(siblings: ProjectSibling[]): string[];
+/** Formats advisory strings for display; `''` when there is nothing to show. */
+export declare function formatProjectAdvisoryReport(advisories: readonly string[]): string;
+/**
+ * Audits whether the projects a change's closing issues belong to are nearly complete, returning
+ * one advisory string per remaining open item — never throws, and callers decide what to do with
+ * the result (e.g. print it, never block on it). A missing/insufficient `project` scope, or a
+ * GraphQL call that fails with a scope error, collapses the whole audit to a single skipped-audit
+ * notice instead of failing. `remainder` overrides `DEFAULT_PROJECT_COMPLETION_REMAINDER`.
+ */
+export declare function auditProjectCompletion(runGh: RunTextCommand, repo: string, closingIssues: ReadonlyArray<ClosingIssueRef>, remainder?: number): Promise<string[]>;
+export {};

package/dist/github-projects/project-audit.mjs

@@ -0,0 +1,77 @@
+import { DEFAULT_PROJECT_COMPLETION_REMAINDER, fetchIssueProjectMemberships, findProjectCompletionSiblings, } from './project-query.mjs';
+function splitOwnerRepo(repo) {
+    const [owner, name] = repo.split('/');
+    if (owner === undefined || name === undefined) {
+        throw new Error(`expected "owner/repo", got "${repo}"`);
+    }
+    return [owner, name];
+}
+/**
+ * Groups a change's closing issues by the open project(s) each belongs to. An issue may belong to
+ * more than one open project (see `fetchIssueProjectMemberships`) — every one it belongs to gets
+ * its own group entry here, audited independently rather than picked arbitrarily.
+ */
+export function groupClosedIssuesByProject(entries) {
+    const grouped = new Map();
+    for (const { closingKey, projects } of entries) {
+        for (const project of projects) {
+            const group = grouped.get(project.id) ?? { keys: new Set(), project };
+            group.keys.add(closingKey);
+            grouped.set(project.id, group);
+        }
+    }
+    return grouped;
+}
+/** Purely advisory formatting: there is no in-body disposition marker to check against, unlike a
+ * milestone-completion audit — every remaining sibling is reported unconditionally. */
+export function formatProjectAdvisories(siblings) {
+    return siblings.map((sibling) => `${sibling.key} ("${sibling.title}") is still open in project "${sibling.projectTitle}" ` +
+        `(${sibling.projectUrl}), which this change is nearly completing.`);
+}
+/** Formats advisory strings for display; `''` when there is nothing to show. */
+export function formatProjectAdvisoryReport(advisories) {
+    if (advisories.length === 0)
+        return '';
+    return [
+        'Project completion advisory (non-blocking, no disposition required):',
+        ...advisories.map((advisory) => `  - ${advisory}`),
+        '',
+    ].join('\n');
+}
+async function resolveClosingIssueProjects(runGh, issue, auditedOwner, auditedRepo) {
+    const [owner, repo] = issue.repo === undefined ? [auditedOwner, auditedRepo] : splitOwnerRepo(issue.repo);
+    const closingKey = `${owner}/${repo}#${issue.number}`.toLowerCase();
+    const result = await fetchIssueProjectMemberships(runGh, owner, repo, issue.number);
+    if (!result.ok) {
+        return {
+            closingKey,
+            projects: [],
+            scopeErrorMessage: result.scopeError ? result.error : undefined,
+        };
+    }
+    return { closingKey, projects: result.projects, scopeErrorMessage: undefined };
+}
+/**
+ * Audits whether the projects a change's closing issues belong to are nearly complete, returning
+ * one advisory string per remaining open item — never throws, and callers decide what to do with
+ * the result (e.g. print it, never block on it). A missing/insufficient `project` scope, or a
+ * GraphQL call that fails with a scope error, collapses the whole audit to a single skipped-audit
+ * notice instead of failing. `remainder` overrides `DEFAULT_PROJECT_COMPLETION_REMAINDER`.
+ */
+export async function auditProjectCompletion(runGh, repo, closingIssues, remainder = DEFAULT_PROJECT_COMPLETION_REMAINDER) {
+    if (closingIssues.length === 0)
+        return [];
+    const [auditedOwner, auditedRepo] = splitOwnerRepo(repo);
+    const resolved = await Promise.all(closingIssues.map((issue) => resolveClosingIssueProjects(runGh, issue, auditedOwner, auditedRepo)));
+    const scopeFailure = resolved.find((entry) => entry.scopeErrorMessage !== undefined);
+    if (scopeFailure !== undefined) {
+        return [`Project completion audit skipped: ${scopeFailure.scopeErrorMessage}`];
+    }
+    const groups = groupClosedIssuesByProject(resolved);
+    if (groups.size === 0)
+        return [];
+    const siblings = await findProjectCompletionSiblings(runGh, groups, remainder);
+    if (siblings.length === 0)
+        return [];
+    return formatProjectAdvisories(siblings);
+}

package/dist/github-projects/project-query.d.mts

@@ -0,0 +1,51 @@
+import type { RunTextCommand } from '../gh-cli/index.mts';
+/**
+ * A reasonable default for `findProjectCompletionSiblings`' `remainder` parameter: once this few
+ * other open items remain in a cross-repo GitHub Projects v2 project a change is touching, the
+ * project is worth calling out as nearly done. Callers may pass their own threshold instead.
+ */
+export declare const DEFAULT_PROJECT_COMPLETION_REMAINDER = 3;
+export type ProjectRef = {
+    id: string;
+    title: string;
+    url: string;
+};
+export type ProjectMembershipResult = {
+    ok: true;
+    projects: ProjectRef[];
+} | {
+    error: string;
+    ok: false;
+    scopeError: boolean;
+};
+export type ProjectGroup = {
+    keys: Set<string>;
+    project: ProjectRef;
+};
+export type ProjectSibling = {
+    key: string;
+    projectTitle: string;
+    projectUrl: string;
+    title: string;
+};
+export declare function isProjectScopeError(message: string): boolean;
+export declare function buildIssueProjectItemsArgs(owner: string, repo: string, number: number): string[];
+/**
+ * Fetches every OPEN project an issue belongs to. An issue can carry more than one `projectItems`
+ * node — a project workflow can add an issue to a project automatically — so this returns every
+ * open one rather than assuming, or requiring, exactly one; callers should audit each
+ * independently rather than picking one arbitrarily. Distinguishes a missing/insufficient
+ * `project` scope (`scopeError: true`; callers typically collapse to a single skipped-audit
+ * notice) from any other failure (callers typically degrade this one issue to "no memberships").
+ */
+export declare function fetchIssueProjectMemberships(runGh: RunTextCommand, owner: string, repo: string, number: number): Promise<ProjectMembershipResult>;
+export declare function buildProjectItemsArgs(projectId: string): string[];
+/**
+ * For each distinct project a change touches, enumerates that project's other open issue items
+ * across every repo it spans — a project has no per-repo scoping, so one query covers all of them
+ * (capped at the first 100 items). Silent (`[]`) once the remainder exceeds `remainder`
+ * (`DEFAULT_PROJECT_COMPLETION_REMAINDER` unless the caller passes its own). A per-project query
+ * failure degrades that one project to "no siblings audited" rather than throwing — every other
+ * project still completes.
+ */
+export declare function findProjectCompletionSiblings(runGh: RunTextCommand, groups: ReadonlyMap<string, ProjectGroup>, remainder?: number): Promise<ProjectSibling[]>;

package/dist/github-projects/project-query.mjs

@@ -0,0 +1,109 @@
+/**
+ * A reasonable default for `findProjectCompletionSiblings`' `remainder` parameter: once this few
+ * other open items remain in a cross-repo GitHub Projects v2 project a change is touching, the
+ * project is worth calling out as nearly done. Callers may pass their own threshold instead.
+ */
+export const DEFAULT_PROJECT_COMPLETION_REMAINDER = 3;
+// GitHub's real wording for a token missing the `project` scope on a ProjectV2 GraphQL field (an
+// insufficient-scopes error, not a 404 or a plain permission denial) — matched case-insensitively
+// against whatever the injected `runGh` surfaces in its thrown error message.
+const SCOPE_ERROR_RE = /insufficient_scopes|required scopes|['"]project['"]\s+scope/i;
+export function isProjectScopeError(message) {
+    return SCOPE_ERROR_RE.test(message);
+}
+export function buildIssueProjectItemsArgs(owner, repo, number) {
+    const query = 'query($owner:String!,$repo:String!,$number:Int!){repository(owner:$owner,name:$repo){issue(number:$number){projectItems(first:20){nodes{project{id title url closed}}}}}}';
+    return [
+        'api',
+        'graphql',
+        '-f',
+        `query=${query}`,
+        '-F',
+        `owner=${owner}`,
+        '-F',
+        `repo=${repo}`,
+        '-F',
+        `number=${number}`,
+    ];
+}
+/**
+ * Fetches every OPEN project an issue belongs to. An issue can carry more than one `projectItems`
+ * node — a project workflow can add an issue to a project automatically — so this returns every
+ * open one rather than assuming, or requiring, exactly one; callers should audit each
+ * independently rather than picking one arbitrarily. Distinguishes a missing/insufficient
+ * `project` scope (`scopeError: true`; callers typically collapse to a single skipped-audit
+ * notice) from any other failure (callers typically degrade this one issue to "no memberships").
+ */
+export async function fetchIssueProjectMemberships(runGh, owner, repo, number) {
+    try {
+        const json = await runGh(buildIssueProjectItemsArgs(owner, repo, number));
+        const parsed = JSON.parse(json);
+        const nodes = parsed.data?.repository?.issue?.projectItems?.nodes ?? [];
+        const projects = [];
+        for (const { project } of nodes) {
+            if (project == null ||
+                project.closed !== false ||
+                typeof project.id !== 'string' ||
+                typeof project.title !== 'string' ||
+                typeof project.url !== 'string') {
+                continue;
+            }
+            projects.push({ id: project.id, title: project.title, url: project.url });
+        }
+        return { ok: true, projects };
+    }
+    catch (err) {
+        const error = err instanceof Error ? err.message : String(err);
+        return { error, ok: false, scopeError: isProjectScopeError(error) };
+    }
+}
+export function buildProjectItemsArgs(projectId) {
+    const query = 'query($id:ID!){node(id:$id){... on ProjectV2{items(first:100){nodes{content{__typename ... on Issue{number title state repository{nameWithOwner}}}}}}}}';
+    return ['api', 'graphql', '-f', `query=${query}`, '-F', `id=${projectId}`];
+}
+function parseOpenProjectIssue(node) {
+    const content = node.content;
+    if (content == null || content['__typename'] !== 'Issue' || content.state !== 'OPEN')
+        return undefined;
+    const { number, title } = content;
+    const nameWithOwner = content.repository?.nameWithOwner;
+    if (typeof number !== 'number' ||
+        typeof title !== 'string' ||
+        typeof nameWithOwner !== 'string') {
+        return undefined;
+    }
+    return { key: `${nameWithOwner.toLowerCase()}#${number}`, title };
+}
+/**
+ * For each distinct project a change touches, enumerates that project's other open issue items
+ * across every repo it spans — a project has no per-repo scoping, so one query covers all of them
+ * (capped at the first 100 items). Silent (`[]`) once the remainder exceeds `remainder`
+ * (`DEFAULT_PROJECT_COMPLETION_REMAINDER` unless the caller passes its own). A per-project query
+ * failure degrades that one project to "no siblings audited" rather than throwing — every other
+ * project still completes.
+ */
+export async function findProjectCompletionSiblings(runGh, groups, remainder = DEFAULT_PROJECT_COMPLETION_REMAINDER) {
+    const results = await Promise.all(Array.from(groups.values()).map(async (group) => {
+        try {
+            const json = await runGh(buildProjectItemsArgs(group.project.id));
+            const parsed = JSON.parse(json);
+            const nodes = parsed.data?.node?.items?.nodes ?? [];
+            const open = nodes
+                .map(parseOpenProjectIssue)
+                .filter((item) => item !== undefined);
+            const remaining = open.filter((item) => !group.keys.has(item.key));
+            if (remaining.length > remainder)
+                return [];
+            return remaining.map((item) => ({
+                key: item.key,
+                projectTitle: group.project.title,
+                projectUrl: group.project.url,
+                title: item.title,
+            }));
+        }
+        catch {
+            return [];
+        }
+    }));
+    return results.flat();
+}

package/dist/index.d.mts

@@ -86,6 +86,8 @@ export { CHECKPOINT_MARKER, isTrustedCheckpointComment, parseCheckpoint, renderC
 export type { Checkpoint, CheckpointCodecOptions, GitHubComment, } from './gha-pr-checkpoint/index.mts';
 export { checkWorkspaceGatesPolicy } from './workspace-gates/index.mts';
 export type { WorkspaceGatesOptions } from './workspace-gates/index.mts';
+export { collectPnpmLicenseReport, evaluatePackageLicenseExpression, evaluatePnpmLicenseReport, parsePnpmLicenseReport, } from './dependency-license-policy/index.mts';
+export type { CollectPnpmLicenseReportOptions, DependencyLicenseAllowlistEntry, DependencyLicenseEvaluation, DependencyLicensePolicy, DependencyLicenseViolation, PnpmLicenseReport, PnpmLicenseReportEntry, } from './dependency-license-policy/index.mts';
 export { validateNugetUpdate } from './nuget-central-version/index.mts';
 export { normalizeSwiftSource } from './swift-semantic-equal/index.mts';
 export { isSwiftCodeOffset, parseUniqueSwiftBinaryTargetChecksum, } from './swift-source-offset/index.mts';

package/dist/index.mjs

@@ -46,6 +46,7 @@ export { assertWorkflowCommandDrift, parseCiLocalArgs, runCiLocal } from './ci-l
 export { GitHubRateLimitError, isRateLimited, isRetryableCancellationError, MAX_RATE_LIMIT_WAIT_MS, rateLimitDelay, reserveRateLimitDelay, } from './gha-rate-limit/index.mjs';
 export { CHECKPOINT_MARKER, isTrustedCheckpointComment, parseCheckpoint, renderCheckpoint, sortedCheckpointCandidates, validateCheckpoint, } from './gha-pr-checkpoint/index.mjs';
 export { checkWorkspaceGatesPolicy } from './workspace-gates/index.mjs';
+export { collectPnpmLicenseReport, evaluatePackageLicenseExpression, evaluatePnpmLicenseReport, parsePnpmLicenseReport, } from './dependency-license-policy/index.mjs';
 export { validateNugetUpdate } from './nuget-central-version/index.mjs';
 export { normalizeSwiftSource } from './swift-semantic-equal/index.mjs';
 export { isSwiftCodeOffset, parseUniqueSwiftBinaryTargetChecksum, } from './swift-source-offset/index.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.16.1",
+  "version": "0.18.0",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {
@@ -268,6 +268,11 @@
       "import": "./dist/workspace-gates/index.mjs",
       "default": "./dist/workspace-gates/index.mjs"
     },
+    "./dependency-license-policy": {
+      "types": "./dist/dependency-license-policy/index.d.mts",
+      "import": "./dist/dependency-license-policy/index.mjs",
+      "default": "./dist/dependency-license-policy/index.mjs"
+    },
     "./nuget-central-version": {
       "types": "./dist/nuget-central-version/index.d.mts",
       "import": "./dist/nuget-central-version/index.mjs",
@@ -298,6 +303,11 @@
       "import": "./dist/gh-cli/index.mjs",
       "default": "./dist/gh-cli/index.mjs"
     },
+    "./github-projects": {
+      "types": "./dist/github-projects/index.d.mts",
+      "import": "./dist/github-projects/index.mjs",
+      "default": "./dist/github-projects/index.mjs"
+    },
     "./gh-api-shell-quoting": {
       "types": "./dist/gh-api-shell-quoting/index.d.mts",
       "import": "./dist/gh-api-shell-quoting/index.mjs",
@@ -323,11 +333,13 @@
     "remark": "15.0.1",
     "remark-gfm": "4.0.1",
     "smol-toml": "1.8.0",
+    "spdx-expression-parse": "5.0.0",
     "yaml": "2.9.0"
   },
   "devDependencies": {
     "@ast-grep/cli": "0.45.3",
     "@types/picomatch": "^4.0.3",
+    "@types/spdx-expression-parse": "4.0.0",
     "agent-blackboard": "^0.5.0"
   },
   "peerDependencies": {

package/skills/github-actions-checklist/SKILL.md

@@ -41,8 +41,29 @@ Apply this portable baseline unless a stricter repository-local rule overrides i
   a deadline of no more than 30 minutes and support cancellation, rollback, or an explicit terminal
   retained/recovery state. An event callback may report completion; it must not hide a longer-running
   operation in another service.
-- Use GitHub-hosted runners only for public repositories. Private repositories use the consumer's
-  approved self-hosted or disposable runner labels.
+- Prefer GitHub-hosted runners for public and private repositories. Choose the smallest hosted runner
+  the job fits, such as `ubuntu-slim` for a short job that needs no Docker daemon, and use a full VM
+  or native-architecture runner only for work the smaller runner cannot do. A consumer that still
+  requires self-hosted or disposable runners names its approved labels in repository-local policy.
+- Keep each job's `timeout-minutes` below any hard platform limit of its runner — for example, no
+  more than 14 minutes on a runner with a 15-minute hard cap that `timeout-minutes` cannot raise —
+  so the job's own cancellation fires first and `always()`/`cancelled()` cleanup steps still run,
+  instead of the runner being killed outright once the platform limit is reached. Give every
+  long-running, network-bound, or waiting step its own `timeout-minutes` inside the job budget, and
+  bound every network call, such as `curl --connect-timeout … --max-time …`.
+- Ephemeral hosted runners start from a clean workspace. Do not add workspace-cleanup steps for them,
+  and check out with `persist-credentials: false` unless a later step must push with that token.
+- Moving a job from a self-hosted or other persistent runner to a GitHub-hosted one drops every
+  piece of runner-local state the job's steps assumed was already there, not just the workspace.
+  Audit for state that used to persist for free: browser installs (a Playwright, Cypress, or
+  Puppeteer cache), package-manager stores (pnpm/npm, Go modules, a Rust `target/` directory,
+  Gradle), `apt-get install` steps that used to be a no-op because the package was already present,
+  and Docker image pulls that used to hit a warm local image store. A step or action comment
+  claiming a tool "persists between runs so caching is not needed" describes the old runner and
+  becomes false the moment `runs-on` changes; replace that assumption with a keyed `actions/cache`
+  step instead. Re-derive `timeout-minutes` from a real passing run on the new runner rather than
+  carrying over a budget calibrated on a warm host — the same job can look intermittently flaky
+  purely because every step now starts cold.
 - Persistent workspaces must check out the full tree. Do not configure sparse checkout; enforce that
   prohibition with a YAML-aware check over intended tracked workflow and action files, with fixtures
   for accepted and rejected shapes.

package/skills/github-issue/SKILL.md

@@ -16,10 +16,15 @@ owner-prefix or visibility assumptions. Immediately before every write, refetch
 require its canonical identity to still match and the repository not to be archived. Issue operations
 also require issues to be enabled and `viewerPermission` of `TRIAGE`, `WRITE`, `MAINTAIN`, or `ADMIN`;
 issue creation additionally requires `viewerCanCreateIssues`. Applying existing metadata to a pull
-request uses the same permission set but does not require issues to be enabled. Creating, changing, or
-deleting taxonomy definitions requires `WRITE`, `MAINTAIN`, or `ADMIN` plus the operation-specific API
-capability. Treat insufficient permission or capability, missing or inaccessible data, identity
-changes, and mismatches as a hard deny that approval cannot override.
+request uses the same permission set but does not require issues to be enabled. Creating, changing,
+or deleting taxonomy definitions requires `WRITE`, `MAINTAIN`, or `ADMIN` plus the operation-specific
+API capability — project-write to create, rename, or close a project. Treat insufficient permission
+or capability, missing or inaccessible data, identity changes, and mismatches as a hard deny that
+approval cannot override. Narrowly within that rule: adding an item to an existing project uses the
+same permission set as applying existing metadata, plus project-write API capability — adding an
+item mutates project membership even though it needs no separate approval; missing project scope or
+capability is a hard deny of the project step alone — skip it, report the gap, and never work around
+it, while the issue and its other metadata still proceed.
 
 When an external creation target is denied, never write there. Search for and create or reuse a
 tracking issue in the current repository, or a consumer-selected tracker. Immediately before that
@@ -48,14 +53,35 @@ repository.
    resolved; otherwise leave state unchanged and report the gap.
 3. Write a self-contained issue with the problem, desired outcome, ownership boundaries, concrete
    areas, validation, and external context. A discovered blocker does not widen implementation scope.
-4. Fetch the complete live taxonomy. Apply matching existing labels and a selected existing milestone
-   without separate approval. Omit a missing optional milestone; a missing required milestone blocks
-   the issue, and milestone creation is a separately authorized taxonomy operation. For a
-   missing label, use [review-github-issue-taxonomy](../review-github-issue-taxonomy/SKILL.md): obtain
-   explicit approval for its exact repository, name, description, and color before creating it.
-   Omit a declined optional label; a missing required label blocks the issue.
-5. Refetch the created or updated issue and verify its metadata. Report a partial failure without
-   retrying creation. Preserve history and report the action, URL, labels, and milestone.
+4. Fetch the complete live taxonomy, including open projects. Apply matching existing labels and a
+   selected existing milestone without separate approval. Select an existing open project for
+   strategic, initiative-level tracking and a milestone for repo-local release or sequencing
+   tracking — the choice turns on the initiative's nature, not how many repositories it touches, so a
+   single-repo strategic initiative can carry a project, and an initiative that needs both a
+   cross-cutting strategic view and repo-local sequencing may carry both; an issue belongs to at
+   most one project and not every issue needs one. Before adding an item, check its project
+   membership and that of any item the project's own automation could pull in alongside it, such as
+   a parent issue's sub-issues; skip the add and report the conflict if any of them already belongs
+   to a different project, instead of creating a second membership. Adding an item to an existing,
+   described project needs no separate approval, the same as applying a milestone — but creating,
+   renaming, or closing a project is a separately authorized taxonomy operation, like milestone
+   creation. A missing project scope or permission skips the project step; report the gap and never
+   work around it. Never set a project item's status to a value that closes the issue unless closing
+   it is separately authorized: GitHub's built-in Auto-close issue project workflow closes the issue
+   when its status changes to Done. When creating a plan issue from a source issue that already has a
+   milestone, apply that same existing milestone. When the source issue already has a project,
+   refetch its current memberships and apply the same project only if exactly one accessible, open
+   membership exists; otherwise skip the project step and report the conflict rather than guess. Omit
+   a missing optional milestone; a missing required milestone blocks the issue, and milestone creation
+   is a separately authorized taxonomy operation. For a missing label, use
+   [review-github-issue-taxonomy](../review-github-issue-taxonomy/SKILL.md): obtain explicit approval
+   for its exact repository, name, description, and color before creating it. Omit a declined
+   optional label; a missing required label blocks the issue.
+5. Refetch the created or updated issue and verify its metadata, including project membership. When
+   an item was added to a project, re-read the project rather than assuming only that item changed —
+   automation such as auto-adding a parent issue's sub-issues can pull in additional items, including
+   into a second project. Report a partial failure without retrying creation. Preserve history and
+   report the action, URL, labels, milestone, and project.
 6. Link a pull request with a closing reference only when it fully resolves the issue. Keep
    cross-repository references fully qualified; PR creation authority remains separate.
 7. Use native sub-issues only for real hierarchy, blocked-by relationships only for genuine known

package/skills/organize-github-issues/SKILL.md

@@ -5,22 +5,29 @@ description: Organize existing GitHub issues and pull requests with the reposito
 
 # Organize GitHub issues
 
-Use for issue hygiene, priority normalization, and milestone assignment. Read local `AGENTS.md`,
-`CLAUDE.md`, and live taxonomy guidance before acting.
+Use for issue hygiene, priority normalization, milestone assignment, and project membership. Read
+local `AGENTS.md`, `CLAUDE.md`, and live taxonomy guidance before acting.
 
-1. Confirm repository identity and fetch the live labels, milestone descriptions, and all required
-   in-scope issue or pull-request evidence. Before mutating, enforce the operation-specific gate from
-   [github-issue](../github-issue/SKILL.md); pull-request metadata does not require issues to be
-   enabled.
+1. Confirm repository identity and fetch the live labels, milestone descriptions, open project
+   descriptions, and all required in-scope issue or pull-request evidence. Before mutating, enforce
+   the operation-specific gate from [github-issue](../github-issue/SKILL.md); pull-request metadata
+   does not require issues to be enabled.
 2. Classify from the permitted metadata and discussion evidence, not implementation guesses. Keep
    automation, ownership, and provenance labels unless local policy explicitly permits changes.
-3. Apply only existing labels and milestones without requesting separate label approval. Do not
-   create taxonomy, close work, rewrite bodies, or alter titles unless the caller separately
-   authorizes that scope.
+3. Apply only existing labels, milestones, and projects without requesting separate label approval;
+   an issue belongs to at most one project, and not every issue needs one. Before adding a project,
+   check the issue's membership and that of any item the project's own automation could pull in
+   alongside it, such as sub-issues; skip the add and report the conflict on any existing membership
+   instead of creating a second one. Never set a project item's status to a value that closes the
+   issue unless the caller separately authorizes closing it. Do not create taxonomy, close work,
+   rewrite bodies, or alter titles unless the caller separately authorizes that scope.
 4. In review mode, report the exact proposed metadata changes without mutating. In apply mode, make
    only necessary, idempotent updates.
-5. Refetch every touched item and verify the requested metadata changed while protected metadata
-   stayed intact. Report changed, unchanged, and ambiguous items separately.
+5. Refetch every touched item and verify the requested metadata, including project membership,
+   changed while protected metadata stayed intact. When an item was added to a project, report any
+   additional item the project's own automation pulled in, such as a parent issue's sub-issues,
+   rather than assuming only the requested item changed. Report changed, unchanged, and ambiguous
+   items separately.
 
-This skill does not define priorities, labels, milestones, clarification policy, or default scope.
-A consumer wrapper supplies the repository-specific taxonomy and permissions.
+This skill does not define priorities, labels, milestones, projects, clarification policy, or
+default scope. A consumer wrapper supplies the repository-specific taxonomy and permissions.

package/skills/planning/SKILL.md

@@ -17,7 +17,9 @@ Use before implementation work that needs a durable plan. Repository-local `AGEN
 4. Specify implementation steps, file-level intent, validation, rollout, and any follow-up that is
    truly outside the accepted scope. Distinguish existing paths from new paths.
 5. Validate and save the plan using the repository's required issue or document workflow before
-   implementation when local policy requires one.
+   implementation when local policy requires one. When creating a plan issue from a source issue
+   that already has a milestone or project, apply that same existing milestone or project through
+   [github-issue](../github-issue/SKILL.md).
 
 For cross-cutting changes, read [impact discovery](references/impact-discovery.md) before selecting
 tests or concluding that a surface has no dependents.

package/skills/retrospective-distill/SKILL.md

@@ -25,6 +25,6 @@ or retention system. Public issue bodies contain only the minimum bounded facts
 needed to establish the problem, proposed work, relevant areas, and validation. Never embed
 unredacted logs, command output, environment details, provider payloads, or transcript content.
 
-This skill supplies no journal API, issue repository, labels, milestones, archival command, or
-approval model. Consumer wrappers cannot weaken this export boundary; they provide only those local
-details.
+This skill supplies no journal API, issue repository, labels, milestones, projects, archival
+command, or approval model. Consumer wrappers cannot weaken this export boundary; they provide
+only those local details.

package/skills/review-github-issue-taxonomy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: review-github-issue-taxonomy
-description: Audit GitHub labels, milestones, and path-label automation and return actionable taxonomy recommendations.
+description: Audit GitHub labels, milestones, projects, and path-label automation and return actionable taxonomy recommendations.
 ---
 
 # Review GitHub issue taxonomy
@@ -8,12 +8,18 @@ description: Audit GitHub labels, milestones, and path-label automation and retu
 Use when the taxonomy itself needs review. Remain read-only unless the caller explicitly authorizes
 local configuration edits or live taxonomy mutation; read local `AGENTS.md` and `CLAUDE.md` first.
 
-1. Confirm repository identity and fetch live labels, descriptions, colors, usage, milestones, and
-   their current scope.
+1. Confirm repository identity and fetch live labels, descriptions, colors, usage, milestones, open
+   and closed projects, and their current scope.
 2. Identify automation-owned labels and inspect local label automation before recommending a rename,
    deletion, or rule change.
 3. Audit aliases, ambiguity, unused labels, missing descriptions, color consistency, milestone
-   overlap, delivery gaps, and path-label coverage.
+   overlap, delivery gaps, and path-label coverage. Audit projects too: a milestone theme duplicated
+   across repositories is a candidate project, and a project holding only routine, non-initiative
+   work — regardless of how many repositories it touches — is a candidate milestone; repository count
+   alone is not a miscategorization signal. Flag a project with no description, an empty or stale project, a closed
+   project with open items, an issue that belongs to more than one project, and a project's own
+   automation for auto-adding a parent issue's sub-issues left enabled where the at-most-one-project
+   rule applies — it can silently duplicate membership.
 4. Return exact recommendations with migration impact and separate safe cleanup from decisions that
    require product or scheduling judgment. Applying an existing label is not taxonomy creation and
    needs no separate approval from the authorized issue operation.
@@ -23,6 +29,6 @@ local configuration edits or live taxonomy mutation; read local `AGENTS.md` and
    label-specific API capability immediately before the approved mutation. `viewerCanCreateIssues`
    applies only to issue creation. Approval for an issue or another label does not transfer.
 
-Do not create or change labels, milestones, issues, or local files for a recommendation-only
-request. This skill does not define a repository's taxonomy or automation file locations; a
-consumer wrapper supplies those integrations and local mechanics.
+Do not create or change labels, milestones, projects, issues, or local files for a
+recommendation-only request. This skill does not define a repository's taxonomy or automation file
+locations; a consumer wrapper supplies those integrations and local mechanics.